Business Email Compromise, often called BEC, is a type of fraud where criminals impersonate a trusted person to trick someone into sending money or sensitive information.
The criminal may pretend to be the company owner, CFO, vendor, attorney, or customer. In some cases, the attacker has already compromised a real email account and is using it directly.
Typical requests include changing bank information, buying gift cards, paying an urgent invoice, or sending tax documents.
BEC can be difficult to spot because the message may not contain malware. The attack depends on trust and urgency.
Businesses should create verification steps for payments and bank changes. For example, any request to change payment information should be confirmed by phone using a known number.
MFA, mailbox monitoring, employee training, and clear financial procedures all help reduce the risk.
The best defense is to make sure one email message is never enough to authorize a high-risk financial action.